Cetus, the main DEX of the Sui ecosystem, fell victim to a hack and lost 223 million dollars

All network participants have been collaborating for four days to recover the stolen funds. After freezing the funds, Cetus launched a proposal to recover them

Cetus, the main DEX of the Sui ecosystem, has been hacked and lost 223 million dollars. After four days of cooperation from all network participants to recover the stolen funds, the initiative faces a setback as the hacker threatens legal action.

The Cetus Story: A Hack and Recovery Efforts

Since its emergence, decentralized finance has fallen victim to hackers targeting funds. In the Sui ecosystem, its main DEX, Cetus, suffered a major hack last week. The attacker manipulated price curves on the DEX using fake tokens to drain the equivalent of 223 million dollars.

On the same day, the Cetus team tried to minimize the problem by communicating only about an oracle bug before being forced to publicly acknowledge the theft. Meanwhile, the hacker, aware that it's only a matter of time before measures are taken to prevent him from using the stolen funds, decided to bridge the equivalent of 60 million dollars to the Ethereum blockchain to swap these funds for ETH.

The Sui network validators then jointly froze the remaining funds (about 160 million dollars), effectively preventing the hacker from using them, allowing Cetus to consider a strategy for recovering the funds.

The Role of the Sui Foundation in the Recovery

As of Friday, the Sui Foundation intervened to negotiate with the hacker who holds 160 million in USDC frozen on the Sui network and more than 20,000 ETH on the Ethereum blockchain. The foundation proposed that the hacker act as a “white hat” instead of risking criminal prosecution. If he returns the frozen funds and the ETH to demonstrate good faith, he can keep as a reward 2,324 ETH, equivalent to 6 million dollars.

However, the hacker has not yet accepted this proposal, and several applications have suspended their activity to complete security audits and ensure they are not vulnerable to the same type of attack.

Cetus has decided to change its strategy by using the governance of the Sui network. Its proposal, posted online this weekend, aims to request a network update to directly reclaim the frozen funds, effectively circumventing the hacker’s actions. This radical method is the same as Ethereum’s hard fork in 2017 following The DAO hack and had divided the community.

This proposal has just received significant support thanks to the support of the Sui foundation. However, it sets two limits on its support: it is informal since the foundation does not use its voting power to ensure the proposal’s success, for reasons of neutrality. Furthermore, the foundation requires that the recovered funds be primarily used to reimburse the application’s users.

Controversy Over the Centralization of the Sui Network

It's positive that Cetus, the validators, and the Sui foundation are collaborating to recover the funds stolen by the hacker and compensate users. However, the freezing of funds has sparked controversy because it contradicts the decentralization of web3.

The freeze was possible through the coordinated action of 114 validators and Mysten Labs, the company that manages the network, by changing the source code in real time without consulting the community. Although the motive may be commendable, it shows that the network and users' funds are not censorship-resistant.

This intervention revives a recurring debate within DeFi: should security take priority at the expense of decentralization?

Four days after the hack of the DEX Cetus, the Sui community must make a decision: should the network be updated to recover the funds? The Sui foundation supports helping compensate users while trying to maintain a semblance of neutrality. But there is no doubt that this hack and its resolution will leave marks on this ecosystem.